The pwdlastset parameter will (obviously) give you the time and date the password was last checked. It's pretty straightforward moving on from there to start doing things like finding which of these users' passwords will expire shortly.